{"id":"CVE-2024-57854","aliases":["EUVD-2024-55467","GHSA-98r5-r223-6xwf"],"status":"published","title":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator","description":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n\nVersion v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.\n\nData::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00451,"percentile":0.39647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-338"],"published":"2026-03-05T02:18:25Z","modified":"2026-06-17T08:14:06Z","products":[{"vendor":"dougdude","product":"net::nsca::client"},{"vendor":"dougdude","product":"net\\"}],"references":[{"url":"https://metacpan.org/release/DOUGDUDE/Net-NSCA-Client-0.009002/source/lib/Net/NSCA/Client/InitialPacket.pm#L119","tags":["Issue Tracking","Product"]},{"url":"https://patch-diff.githubusercontent.com/raw/dougwilson/perl5-net-nsca-client/pull/2.patch","tags":["patch","Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/05/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57854"},{"url":"https://github.com/advisories/GHSA-98r5-r223-6xwf"}],"sources":{"cve":[{"id":"CVE-2024-57854","title":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator","description":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n\nVersion v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.\n\nData::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.","status":"published","published":"2026-03-05T02:18:25.951Z","modified":"2026-03-05T16:41:19.727Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-55467","description":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n\nVersion v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.\n\nData::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.","status":"published","published":"2026-03-05T02:18:25Z","modified":"2026-03-05T16:41:19Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:48:08.87511Z"}],"ghsa":[{"id":"GHSA-98r5-r223-6xwf","title":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n...","description":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n\nVersion v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.\n\nData::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.","status":"published","published":"2026-03-05T03:31:26Z","modified":"2026-03-05T21:30:38Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:06:28.064128Z"}],"nvd":[{"id":"CVE-2024-57854","description":"Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.\n\nVersion v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors.\n\nData::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.","status":"published","published":"2026-03-05T03:15:53.953Z","modified":"2026-06-17T08:14:06.687Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:10:47.77313Z"}]}}